[Windows] Security model for files permissions - STEP 3d (#6968)

* Implement security.mkdir and security.makedirs

* Fix lint

* Correct mock

* Rename security into filesystem

* Update apache and nginx plugins requirements

* Update certbot/plugins/webroot.py

Co-Authored-By: ohemorange <ebportnoy@gmail.com>

* Reenable pylint here

* Move code

* Reimplement mkdir

* Control errors on eexist, remove superfluous chmod for makedirs

* Add proper skip for windows only tests

* Fix lint

* Fix mypy

* Clean code

* Adapt coverage threshold on Linux with addition of LOC specific to Windows

* Add forbiden functions to tests

* Update certbot/compat/os.py

Co-Authored-By: ohemorange <ebportnoy@gmail.com>

* Simplify code

* Sync _get_current_user with part3c

* Use the simpliest implementation

* Remove exist_ok, simplify code.

* Simplify inline comment

* Update filesystem_test.py

* Update certbot/compat/os.py

Co-Authored-By: ohemorange <ebportnoy@gmail.com>

* Update certbot/plugins/webroot.py

Co-Authored-By: ohemorange <ebportnoy@gmail.com>

* Update certbot/plugins/webroot.py

Co-Authored-By: ohemorange <ebportnoy@gmail.com>

* Add a test to check we set back os.mkdir correctly after filesystem.makedirs is called.

* Fix lint, adapt coverage

certbot/plugins/common_test.py

@@ -15,6 +15,7 @@ from certbot import achallenges
 from certbot import crypto_util
 from certbot import errors
 from certbot.compat import os
+from certbot.compat import filesystem
 from certbot.tests import acme_util
 from certbot.tests import util as test_util
 
@@ -95,7 +96,7 @@ class InstallerTest(test_util.ConfigTestCase):
 
     def setUp(self):
         super(InstallerTest, self).setUp()
-        os.mkdir(self.config.config_dir)
+        filesystem.mkdir(self.config.config_dir)
         from certbot.plugins.common import Installer
 
         self.installer = Installer(config=self.config,

certbot/plugins/manual_test.py

@@ -9,6 +9,7 @@ from acme import challenges
 
 from certbot import errors
 from certbot.compat import os
+from certbot.compat import filesystem
 from certbot.tests import acme_util
 from certbot.tests import util as test_util
 
@@ -23,7 +24,7 @@ class AuthenticatorTest(test_util.TempDirTestCase):
         self.dns_achall_2 = acme_util.DNS01_A_2
         self.achalls = [self.http_achall, self.dns_achall, self.dns_achall_2]
         for d in ["config_dir", "work_dir", "in_progress"]:
-            os.mkdir(os.path.join(self.tempdir, d))
+            filesystem.mkdir(os.path.join(self.tempdir, d))
             # "backup_dir" and "temp_checkpoint_dir" get created in
             # certbot.util.make_or_verify_dir() during the Reverter
             # initialization.

certbot/plugins/storage_test.py

@@ -6,6 +6,7 @@ import mock
 from certbot import errors
 
 from certbot.compat import os
+from certbot.compat import filesystem
 from certbot.plugins import common
 from certbot.tests import util as test_util
 
@@ -16,7 +17,7 @@ class PluginStorageTest(test_util.ConfigTestCase):
     def setUp(self):
         super(PluginStorageTest, self).setUp()
         self.plugin_cls = common.Installer
-        os.mkdir(self.config.config_dir)
+        filesystem.mkdir(self.config.config_dir)
         with mock.patch("certbot.reverter.util"):
             self.plugin = self.plugin_cls(config=self.config, name="mockplugin")
 

certbot/plugins/webroot.py

@@ -19,6 +19,7 @@ from certbot import cli
 from certbot import errors
 from certbot import interfaces
 from certbot.compat import os
+from certbot.compat import filesystem
 from certbot.display import ops
 from certbot.display import util as display_util
 from certbot.plugins import common
@@ -173,10 +174,10 @@ to serve all files under specified web root ({0})."""
                 # as it does not correspond to a folder path ('/' or 'C:')
                 for prefix in sorted(util.get_prefixes(self.full_roots[name])[:-1], key=len):
                     try:
-                        # This is coupled with the "umask" call above because
-                        # os.mkdir's "mode" parameter may not always work:
+                        # This is coupled with the "umask" call above because os.mkdir's
+                        # "mode" parameter may not always work under Linux:
                         # https://docs.python.org/3/library/os.html#os.mkdir
-                        os.mkdir(prefix, 0o0755)
+                        filesystem.mkdir(prefix, 0o0755)
                         self._created_dirs.append(prefix)
                         # Set owner as parent directory if possible
                         try:

certbot/plugins/webroot_test.py

@@ -203,7 +203,7 @@ class AuthenticatorTest(unittest.TestCase):
         self.assertFalse(os.path.exists(self.partial_root_challenge_path))
 
     def test_perform_cleanup_existing_dirs(self):
-        os.mkdir(self.partial_root_challenge_path)
+        filesystem.mkdir(self.partial_root_challenge_path)
         self.auth.prepare()
         self.auth.perform([self.achall])
         self.auth.cleanup([self.achall])
@@ -219,7 +219,7 @@ class AuthenticatorTest(unittest.TestCase):
             domain="thing.com", account_key=KEY)
 
         bingo_validation_path = "YmluZ28"
-        os.mkdir(self.partial_root_challenge_path)
+        filesystem.mkdir(self.partial_root_challenge_path)
         self.auth.prepare()
         self.auth.perform([bingo_achall, self.achall])
 
@@ -235,7 +235,7 @@ class AuthenticatorTest(unittest.TestCase):
         self.auth.perform([self.achall])
 
         leftover_path = os.path.join(self.root_challenge_path, 'leftover')
-        os.mkdir(leftover_path)
+        filesystem.mkdir(leftover_path)
 
         self.auth.cleanup([self.achall])
         self.assertFalse(os.path.exists(self.validation_path))